MAL-2026-4227 Malicious code in lognest (PyPI)

On import lognest, the package's init.py spawns a detached background subprocess running a sibling _check.py (lognest/init.py:25 subprocess.Popen([sys.executable, os.path.join(base_dir, "_check.py")], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)). That script enters an infinite loop POSTing to https://pypkg.dev/project/logger/json — a lookalike of pypi.org — with TLS verification explicitly disabled via ssl._create_unverified_context() (lognest/_check.py:22). On the first request it exfiltrates the absolute install path (Path(__file__).resolve().parent) which typically encodes the installer's username, virtualenv layout, or CI runner path (lognest/_check.py:18). Server responses are base64-decoded and dispatched on background threads (lognest/_check.py:31), giving the operator a persistent C2 channel for delivering second-stage payloads to any process that imports the package. None of this behavior matches the package's advertised purpose as a logger. The combination of import-time background process, lookalike non-publisher host, TLS-disable, install-path exfiltration, and base64-decoded response dispatch is an unambiguous attacker-controlled remote-execution channel.

Package silently executes remote code during import.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-05-lognest

Reasons (based on the campaign):

• Downloads and executes a remote malicious script.